--- title: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines description: The Nefilim ransomware group, known to be active since February 2020, adopts the Nemty ransomware code written in the Delphi programming language. It uses a Citrix vulnerability/RDP to access corporate networks. Nefilim started its own data leak site called ‘Corporate Leaks,’ where the operators publish exfiltrated data from compromised organizations if they refuse to pay. canonical_url: https://www.acronis.com/en/tru/posts/nefilim-ransomware-uses-citrix-vulnerability-to-compromise-victims-machines/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 20 September 2020 # Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines The Nefilim ransomware group, known to be active since February 2020, adopts the Nemty ransomware code written in the Delphi programming language. It uses a Citrix vulnerability/RDP to access corporate networks. Nefilim started its own data leak site called ‘Corporate Leaks,’ where the operators publish exfiltrated data from compromised organizations if they refuse to pay. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** The Nefilim ransomware group, known to be active since February 2020, adopts the Nemty ransomware code written in the Delphi programming language. It uses a Citrix vulnerability/RDP to access corporate networks. Nefilim started its own data leak site called ‘Corporate Leaks,’ where the operators publish exfiltrated data from compromised organizations if they refuse to pay. ### Summary * First seen in February 2020Uses AES-128-CTR and RSA-2048 encryption algorithms * Distributed in many variants: Nephilim, OFFWHITE, SIGARETA, Telegram. * Uses Citrix vulnerability/RDP to enter the victim machine * Written in Borland Delphi * Supposed to be a Nemty successor with simplified encryption ### Distribution Nefilim is most likely distributed through exposed Citrix virtual desktop interfaces (VDI) and Remote Desktop Services (RDP). ### Obfuscation Nefilim employs an obfuscation technique to hide imported functions. During the runtime linking, Nefilim enumerates the functions from shell32.dll and calculates hex representation of their names. If values are matched, the API is imported. It converts the API name to hex format, then matches with the ones from the system DLL. ![Image 1: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/05813bf02350950b918a78911f40b36a.png) For example, to import the CommandLineToArgvW() function, it pushes ‘436F6D6D616E644C696E65546F4172677657’ to the stack to compare. ![Image 2: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/d2a1ab3a07b52632fd321d2030de5472.png) ### Encryption First, the ransomware imports the RSA-2048 master public key, which is hardcoded in Base64 format. ![Image 3: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/bd6af81029198efe40d75f2ea874808e.png) The key is decoded to BLOB format with the help of CryptStringToBinary() and the ‘CRYPT_STRING_BASE64’ flag: ![Image 4: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/4cbf28eeaa20b02d6b72de1f7edc2887.png) Encryption is done in 26 threads to speed up the encryption process. Nefilim generates 128-bit file keys using SystemFunction036() — a.k.a. RtlGenRandom() — from advapi32.dll for AES encryption. ![Image 5: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/811d7207c4fe3f7c215a40c0609edc8f.png) ![Image 6: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/de839bf5c93595993d9ff12407020605.png) Nefilim uses the AES CTR mode that turns a block cipher into a stream cipher. It generates the next keystream by using the successive values of a counter, which is any numerical sequence that does not repeat for a long time (usually incrementing the value by one). CTR mode is well-suited to operate in a multithread mode where blocks can be encrypted in parallel. ![Image 7: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/39cba68ec6910b8c1d7caff061738214.png) The encrypted files are appended with ‘SIGARETA’ (eng. ‘cigarette’) extension: ![Image 8: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/728a4744b445344f0283927ac7ed9287.png) The footer of the encrypted file contains the file key and IV, encrypted by the RSA-2048 master public key and terminated with the signature ‘SIGARETA’. ![Image 9: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/9ceb4c659f6bd057435229f7b646f5a8.png) During encryption, Nefilim avoids folders and files that have the following strings: windows $recycle.bin rsa ntuser.dat programdata appdata program files program files (x86) exe log cab cmd com cpl ini dll url ttf mp3 pif mp4 SIGARETA msi SIGARETA-RESTORE.txt Nefilim additionally provides the command line arguments to encrypt a single file or disk. ![Image 10: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/dfdb35287e231ebd8e6fec7593a3595d.png) ### Easter eggs Nefilim ransomware contains funny names, mostly based on Russian people. The Mutex name is written in Russian, but uses the Latin alphabet rather than Cyrillic. ![Image 11: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/f8166fbf18c4d3160f81a89257abd367.png) The name of the crypto container also looks weird. ![Image 12: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/e683f6d053456c988ee60ab4511a604d.png) The pdb file location contains the Russian words ‘pahan’ (‘father’) and ‘sigareta’ (‘a cigarette’). ### Ransom note The hardcoded ransom note is Base64-encoded and encrypted using AES-128-CTR with key ‘asdfasdffdasfdas’ and IV ‘fsdafadsfsadfads’: ![Image 13: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/84b8ad8763af2fb73def484d076f305a.png) The ransom note is decrypted and stored in the root folder of the encrypted disks: ![Image 14: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/e4a48b33073873a1fb95c86394f93218.png) Once encryption is finished, Nefilim creates an image, putting the ransom note content in Yu Gothic Light font and setting it up as a wallpaper. ![Image 15: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/55d5c1c406a941841a0a6cec344fa336.png) The image itself is stored in the %TEMP% folder and is called ‘virubim_eshky.jpg’. ![Image 16: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/4c302b0d7957d66b4ab1c6e526053620.png) ### Decryption service Decryption without paying a ransom is not possible. The ransom note contains the email addresses to contact the attackers. It also provides a link to a site on the Tor network where leaked data is published: http://hxt254aygrsziejn.onion. The site contains data stolen from 17 organizations. ![Image 17: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/35cbba3914d3df332e294c28b663fe89.png) ![Image 18: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/b42b552f3a4bf6a4a3842767c50eeef7.png) ### Detection by Acronis Cyber Protect Nefilim ransomware is detected and blocked by Acronis cyber protection solutions. ![Image 19: Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://staticfiles.acronis.com/images/content/bc6ce5b464113a9a17834fa0dc6bbbc1.png) ### Conclusion Nefilim adopts the tactics and techniques of Nemti ransomware, including Object Pascal code (unusual for modern software). Based on strings found in the code, Nefilim was created by Russian programmers. Following the Maze cartel trend, the operators of Nefilim have their own data leak site where they have already reported 17 victims who didn’t pay the ransom. ### IoCs SHA256: 24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0 DineshSchwartz1965@protonmail.com RupertMariner1958@protonmail.com StephanForenzzo1985@protonmail.com http://hxt254aygrsziejn.onion http://corpleaks.net (not active now) SIGARETA_RESTORE.TXT .SIGARETA Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)